Effective anomaly detection from logs is crucial for enhancing cybersecurity defenses by enabling the early identification of threats. Despite advances in anomaly detection, existing systems often fall short in areas such as post-detection validation, scalability, and effective maintenance. These limitations not only hinder the detection of new threats but also impair overall system performance. To address these challenges, we propose CEDLog, a novel practical framework that integrates Elastic Weight Consolidation (EWC) for continual learning and implements distributed computing for scalable processing by integrating Apache Airflow and Dask. In CEDLog, anomalies are detected through the synthesis of Multi-layer Perceptron (MLP) and Graph Convolutional Networks (GCNs) using critical features present in event logs. Through comparisons with update strategies on large-scale datasets, we demonstrate the strengths of CEDLog, showcasing efficient updates and low false positives
@article{arxiv.2504.02322,
title = {Distributed Log-driven Anomaly Detection System based on Evolving Decision Making},
author = {Zhuoran Tan and Qiyuan Wang and Christos Anagnostopoulos and Shameem P. Parambath and Jeremy Singer and Sam Temple},
journal= {arXiv preprint arXiv:2504.02322},
year = {2025}
}
Comments
This paper has been accepted at 45th IEEE International Conference on Distributed Computing Systems